CVE-2026-42606
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
AzuraCast before version 0.23.6 has a vulnerability in the ApplyXForwarded middleware that unconditionally trusts the X-Forwarded-Host header without a trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL by injecting this header during the forgot-password flow. When the victim clicks the link, the reset token is exfiltrated, allowing full account takeover and destruction of 2FA configuration.
Risk Assessment
An attacker can fully compromise user accounts, including password reset and disabling two-factor authentication, leading to data breach.
Recommendation
Update AzuraCast to version 0.23.6 or later, which contains the fix.
Other vulnerabilities in AzuraCast
See all- CVE-2026-76836High
AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit deserializes with that group while requiring only StationPermissions::Profile. AbstractArrayEntity::fromArray() then assigns every public property with no field-level permission check, so custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade and custom_config_bottom are writable through it. ConfigWriter::writeCustomConfigurationSection() emits those values verbatim into the generated Liquidsoap .liq script, where the process.run() and process.exec() built-ins execute operating system commands when the backend restarts, which the built-in sync task triggers automatically once needs_restart is set. The dedicated endpoint for the same data, PUT /api/station/{id}/liquidsoap-config, requires StationPermissions::Broadcasting, so a station manager holding only the profile permission reaches configuration that the intended boundary reserves for broadcasting operators.
- CVE-2026-42605High
A vulnerability in AzuraCast prior to version 0.23.6 allows an authenticated user with media management permissions to write arbitrary files outside the station's media storage directory via an unsanitized currentDirectory parameter in the Flow.js upload endpoint. This can lead to remote code execution by writing a PHP webshell.
Original NVD description (English source)
AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting this header when triggering the forgot-password flow. When the victim clicks the poisoned link, their reset token is exfiltrated to the attacker's server. The attacker then uses the token on the real instance to reset the victim's password and destroy their 2FA configuration, achieving full account takeover. This issue has been patched in version 0.23.6.